Implement Azure security →easyMultiple ChoiceObjective-mapped

AZ-204 Implement Azure security Practice Question

You are developing an API that will be hosted on Azure API Management (APIM). The API must be accessible only to clients that present a valid JSON Web Token (JWT) issued by Microsoft Entra ID. Which APIM policy should you use to validate the JWT?

⚠ Common exam trap

It's easy for candidates to confuse <check-header> with <validate-jwt>, assuming that simply checking for the presence of the Authorization header is sufficient for JWT validation, but <check-header> performs no cryptographic verification or claim validation, leaving the API vulnerable to forged or expired tokens.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" />

The <validate-jwt> policy in Azure API Management is specifically designed to enforce the presence and validity of a JSON Web Token (JWT) in incoming requests. By setting the header-name attribute to 'Authorization' and failed-validation-httpcode to '401', the policy checks that the JWT in the Authorization header is cryptographically signed by Microsoft Entra ID and has not expired, rejecting invalid or missing tokens with a 401 Unauthorized response.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
<cors allow-credentials="true" />
Why it's wrong here
The <cors allow-credentials="true" /> policy in Azure API Management is designed to manage Cross-Origin Resource Sharing, a browser security feature that restricts web pages from making requests to a different domain than the one that served the web page. While crucial for web application security, it solely addresses browser-initiated cross-origin requests and does not perform any form of authentication or validate the integrity or authenticity of a security token like a JWT.
✗
<authenticate-basic />
Why it's wrong here
The <authenticate-basic /> policy implements HTTP Basic authentication, which involves sending a username and password, Base64-encoded, in the Authorization header. This is a distinct and much simpler authentication mechanism compared to JSON Web Tokens. It does not involve cryptographic signatures, claims validation, or the structured token format inherent to JWTs, making it unsuitable for validating a JWT-based authentication scheme.
✓
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" />
Why this is correct
The <validate-jwt header-name="Authorization" failed-validation-httpcode="401" /> policy is specifically engineered within Azure API Management to perform comprehensive validation of JSON Web Tokens. It verifies the token's cryptographic signature using a specified key, checks the issuer (iss) and audience (aud) claims, and ensures the token has not expired (exp claim). This policy is the correct mechanism for robustly authenticating requests secured with JWTs by ensuring their integrity and authenticity.
✗
<check-header name="Authorization" failed-check-httpcode="401" />
Why it's wrong here
The <check-header> policy merely verifies the presence of a specified HTTP header and optionally checks its value against a predefined pattern. While it can confirm an 'Authorization' header exists, it performs no cryptographic validation, signature verification, or examination of the token's claims or expiration date. This policy is insufficient for authenticating requests based on the validity and integrity of a JWT.

Go deeper

AZ-204 Implement Azure security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question